Merge conflict marker in composer.lock causes autoload.php file to contain invalid php syntax after composer install

Author: hostepCreated Aug 26, 2026Updated Aug 27, 2026

Created as follow up from https://github.com/composer/composer/pull/11517#issuecomment-5411457372

My composer.json:

json

{
    "name": "vendor/test",
    "minimum-stability": "stable",
    "require": {}
}

My composer.lock:

json

{
    "_readme": [
        "This file locks the dependencies of your project to a known state",
        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
        "This file is @generated automatically"
    ],
<<<<<<< HEAD
    "content-hash": "2e7be2ea4bdb6deb3ff2826621f02c46",
||||||| 80ba9167
    "content-hash": "57f98f4c651b894d654eb3d465a648b1",
=======
    "content-hash": "e4b192e093a0a4647d7b0ef25f8d5e2d",
>>>>>>> something
    "packages": [],
    "packages-dev": [],
    "aliases": [],
    "minimum-stability": "stable",
    "stability-flags": {},
    "prefer-stable": false,
    "prefer-lowest": false,
    "platform": {},
    "platform-dev": {},
    "plugin-api-version": "2.9.0"
}

Output of composer diagnose:

...
Composer version: 2.10.2
Checking Composer and its dependencies for vulnerabilities: OK
PHP version: 8.5.9
...
Checking composer.lock:
In JsonFile.php line 398:

  "./composer.lock" does not contain valid JSON
  Parse error on line 6:
  ...tomatically"    ],<<<<<<< HEAD    "co
  --------------------^
  Expected: 'STRING' - It appears you have an extra trailing comma

When I run this command: rm -Rf vendor/ && composer install, it runs fine without errors and when I look at the resulting file vendor/autoload.php, I notice a broken php line at the bottom:

return ComposerAutoloaderInitVCS merge conflict detected. Please run `composer update --lock`.::getLoader();

And I expected this to happen: Running composer install should throw an error if the composer.lock is invalid

Source: composer/composer

View original on GitHub View discussion on GitHub